Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by b06timmer on Tuesday August 23, 2022 @07:16PM (#32572847)

I did the same thing on a server for a major department store chain in the '90s. I booted a Linux diskette and copied the SAM file to it. I also ran l0phtcrack, or John the Ripper on a 486 (?) PC in my apartment. I think I bought a rainbow table and something else to expand the iterations it would use on the hashes. I let it run for over a week and had a couple of thousand clear passwords. This was for every store west of the Mississippi and included most of the "big-wigs" in our chain.

I was going to send the information to our security people in another state but decided it probably wouldn't be a wise thing to do.

I come across the HDD where I have this stuff archived every now and then and it makes me smile. This was also in the "Free Kevin" days.

[ Parent | on HN ]

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by KennyBlanken on Tuesday August 23, 2022 @07:46PM (#32573148)

So you copied the auth file off company servers

and cracked it on personal systems

and you kept the files and cracked passwords? Not just kept around, but archived?

Dude.

[ Parent | on HN ]

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by mrelectric on Tuesday August 23, 2022 @08:35PM (#32573552)

I think most of us in sec do that.

[ Parent | on HN ]